CVE-2021-47061

What it actually does

Use-after-free in KVM I/O bus device handling when a new bus allocation fails during unregister; devices may be destroyed before SRCU synchronization ensures all readers observe the null bus, allowing dangling references.

Why it matters to the business

Potential system instability, crashes, or local privilege escalation in virtualized Linux environments running KVM, increasing risk for hosts that have not applied recent kernel updates.

How an attack unfolds

An attacker with local access triggers an I/O bus unregister operation that fails to allocate a replacement bus, races the destruction of devices against concurrent readers that hold SRCU references, and reuses the freed memory to corrupt kernel state.

How to fix it

Update the Linux kernel to a version containing the fix that defers device destruction until after SRCU synchronization completes; rebuild and reboot affected hosts.

How to confirm the fix worked

Confirm the running kernel version includes the patch; inspect KVM I/O bus code for the post-sync destruction ordering; run targeted regression tests exercising bus unregister failure paths.

Typical attack path

1. Obtain local code execution on a KVM host
2. Trigger repeated I/O bus device register/unregister operations to induce allocation failure
3. Race device destruction with SRCU-protected readers
4. Reuse freed device structures to achieve arbitrary kernel read/write
5. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for use-after-free warnings or oops involving kvm_io_bus or SRCU; correlate with processes performing frequent I/O bus operations; examine crash dumps for freed KVM device structures.

What your security team should do

• Prioritize kernel updates on all KVM hosts within standard change windows
• Monitor for unusual KVM-related kernel oops or warnings
• Restrict local access on virtualization hosts until patched